Code signing has been a popular topic over the last fortnight.
- Yahoo was quick to patch an embarrassing key management error with the signing key used in their new Axis browser extension for Chrome that was discovered by Security blogger Nik Cubrilovic [1].
- Microsoft has published [2] a security advisory revoking trust in a number of digital certificates that may have been abused to sign parts of the recently discovered “Flame” malware.
The use of code signing technology is an essential tool in helping to establish the trust we now demand from the Internet of things. It’s worth taking a moment to consider the potential impact when there’s a loss of control of a code signing key or certificate.